Integrated risk management

The Central Denmark Region, along with other regions and critical service providers, are having to contend with a number of challenging factors in the current climate. These include increasing cyberattacks, geopolitical tensions, growing compliance requirements and increasing digitalisation needs across business units.

Back in 2015, the Central Denmark Region produced a security report with 41 suggestions for security improvements. One of those suggestions was the creation of the SOC, which has since become a reality.

“With this in mind, we have chosen to organise our security efforts in a virtually integrated structure. We have a Security Operations Centre – the SOC – which is responsible for the continuous monitoring of the region’s IT systems and can react quickly when suspicious activity or disruptions occur. We have a Security Analytics Centre – the SAC – which can drill down into security incidents and strengthen our ability to prevent and manage threats. And we have our group-wide risk management model that sets the framework for how we work with compliance”, say Kenneth Becker, Head of Strategy and Governance and CISO in the Central Denmark Region

Based on the report’s other recommendations, the Central Denmark Region has undergone an internal maturation process lasting some years, which has significantly strengthened the organisation’s security level. Vaern has been on board as the region’s strategic sparring partner for much of this process.

According to the Central Denmark Region, the key to their security work is an integrated approach to risk management and risk handling. Security capabilities are not physically located in one place, such as an operations department, but instead are organisationally anchored across units and functions. This structure ensures that security is not something that is handled in compartmentalised silos; but deeply rooted in the region’s IT and business operations.